integer.go

package conformance

import (
	"context"
	"encoding/json"
	"fmt"
	"sync"
	"testing"
	"time"

	"github.com/operatorstack/boatstack/boatstack/kernel"
)

const (
	integerDomainContractFingerprint          = "61af3c7a11200a92087cbff475230ff6b19bb0440e3ba77dd0247ea60227f6b8"
	alternateIntegerDomainContractFingerprint = "af13a3dd586f031d960a72ef1dfa58e0cef139b91a334b38aab39b3af772073f"
)

// IntegerDomain is the reference non-software domain.
type IntegerDomain struct {
	mu                     sync.Mutex
	value                  int
	executions             map[string]int
	interruptNextIncrement bool
	panicNextIncrement     bool
}

func (d *IntegerDomain) Observe(context.Context, string) (kernel.Observation, error) {
	d.mu.Lock()
	defer d.mu.Unlock()
	return kernel.NewObservation(struct {
		Value int `json:"value"`
	}{d.value})
}

func (d *IntegerDomain) Admissible(_ context.Context, evaluation kernel.Evaluation) (bool, string, error) {
	var observed struct {
		Value int `json:"value"`
	}
	if err := json.Unmarshal(evaluation.Observation.Value, &observed); err != nil {
		return false, "", err
	}
	switch evaluation.Transition.Operation {
	case "objective.bind":
		return evaluation.State.ObjectiveBinding == nil && evaluation.Objective != nil, "objective is not yet bound", nil
	case "counter.increment":
		return evaluation.Objective != nil && observed.Value < 2, "exact objective is present and value is below target", nil
	case "counter.reset":
		return observed.Value > 0 || evaluation.State.Recovery != nil, "value is nonzero or recovery remains active", nil
	case "counter.hold":
		return true, "hold preserves the counter and is admissible from every declared source mode", nil
	default:
		return false, "unknown transition", nil
	}
}

func (d *IntegerDomain) Verify(_ context.Context, evaluation kernel.Evaluation, _ kernel.Effect, target kernel.Observation) error {
	var before, after struct {
		Value int `json:"value"`
	}
	if err := json.Unmarshal(evaluation.Observation.Value, &before); err != nil {
		return err
	}
	if err := json.Unmarshal(target.Value, &after); err != nil {
		return err
	}
	switch evaluation.Transition.Operation {
	case "objective.bind":
		if before.Value != after.Value {
			return fmt.Errorf("objective binding changed domain state")
		}
	case "counter.increment":
		if after.Value != before.Value+1 {
			return fmt.Errorf("increment postcondition failed")
		}
	case "counter.reset":
		if after.Value != 0 {
			return fmt.Errorf("reset postcondition failed")
		}
	case "counter.hold":
		if before.Value != after.Value {
			return fmt.Errorf("hold changed domain state")
		}
	}
	return nil
}

func (d *IntegerDomain) changeObservation() {
	d.mu.Lock()
	defer d.mu.Unlock()
	d.value++
}

func (d *IntegerDomain) interruptNext() {
	d.mu.Lock()
	defer d.mu.Unlock()
	d.interruptNextIncrement = true
}

func (d *IntegerDomain) panicNext() {
	d.mu.Lock()
	defer d.mu.Unlock()
	d.panicNextIncrement = true
}

func (d *IntegerDomain) effectCounts() map[string]int {
	d.mu.Lock()
	defer d.mu.Unlock()
	copy := make(map[string]int, len(d.executions))
	for transition, count := range d.executions {
		copy[transition] = count
	}
	return copy
}

// IntegerOperator applies the reference domain operations.
type IntegerOperator struct{ Domain *IntegerDomain }

func (o IntegerOperator) Execute(_ context.Context, operation kernel.Operation) (kernel.Effect, error) {
	o.Domain.mu.Lock()
	defer o.Domain.mu.Unlock()
	o.Domain.executions[operation.Transition.ID]++
	switch operation.Transition.Operation {
	case "objective.bind":
	case "counter.increment":
		o.Domain.value++
		if o.Domain.interruptNextIncrement {
			o.Domain.interruptNextIncrement = false
			return kernel.Effect{}, fmt.Errorf("simulated interrupted operator")
		}
		if o.Domain.panicNextIncrement {
			o.Domain.panicNextIncrement = false
			panic("simulated process panic")
		}
	case "counter.reset":
		o.Domain.value = 0
	case "counter.hold":
	default:
		return kernel.Effect{}, fmt.Errorf("unknown operation")
	}
	facet := "counter.value"
	if operation.Transition.Operation == "objective.bind" {
		facet = "supervisor.objective"
	}
	return kernel.Effect{Facts: []kernel.EffectFact{{Facet: facet, Operation: operation.Transition.Operation, Fingerprint: fmt.Sprintf("value-%d", o.Domain.value)}}}, nil
}

// IntegerCapabilities classifies the reference operations.
type IntegerCapabilities struct{}

func (IntegerCapabilities) RequiredCapabilities(transition kernel.Transition) ([]kernel.Capability, error) {
	switch transition.Operation {
	case "objective.bind":
		return []kernel.Capability{"objective.bind"}, nil
	case "counter.increment":
		return []kernel.Capability{"counter.increment"}, nil
	case "counter.reset":
		return []kernel.Capability{"counter.reset"}, nil
	case "counter.hold":
		return []kernel.Capability{"counter.hold"}, nil
	default:
		return nil, fmt.Errorf("unclassified operation %q", transition.Operation)
	}
}

// MemoryReceipts records committed receipts for one control instance in the
// reference store.
type MemoryReceipts struct {
	mu     sync.Mutex
	values []kernel.Receipt
}

func (r *MemoryReceipts) append(receipt kernel.Receipt) {
	r.mu.Lock()
	defer r.mu.Unlock()
	r.values = append(r.values, receipt)
}

func (r *MemoryReceipts) snapshot() []kernel.Receipt {
	r.mu.Lock()
	defer r.mu.Unlock()
	return append([]kernel.Receipt(nil), r.values...)
}

// memoryInstance is one durable instance record in the reference store.
type memoryInstance struct {
	state    kernel.ControlState
	receipts *MemoryReceipts
	commits  int
}

// MemoryStateStore is the keyed multi-instance, revision-CAS reference
// Store. Every operation routes by the explicit instance identity; state,
// receipts, revisions, and compare-and-swap are local to one instance.
type MemoryStateStore struct {
	mu             sync.Mutex
	instances      map[string]*memoryInstance
	current        string
	commitFailures int
}

// NewMemoryStateStore returns an empty multi-instance reference store.
func NewMemoryStateStore() *MemoryStateStore {
	return &MemoryStateStore{instances: map[string]*memoryInstance{}}
}

func (s *MemoryStateStore) Create(_ context.Context, instanceID string, initial kernel.ControlState) error {
	s.mu.Lock()
	defer s.mu.Unlock()
	if initial.InstanceID != instanceID {
		return fmt.Errorf("initial control state belongs to %q, not %q", initial.InstanceID, instanceID)
	}
	if _, ok := s.instances[instanceID]; ok {
		return kernel.InstanceExistsError{InstanceID: instanceID}
	}
	s.instances[instanceID] = &memoryInstance{state: cloneState(initial), receipts: &MemoryReceipts{}}
	if s.current == "" {
		s.current = instanceID
	}
	return nil
}

func (s *MemoryStateStore) Load(_ context.Context, instanceID string) (kernel.InstanceRecord, error) {
	s.mu.Lock()
	defer s.mu.Unlock()
	instance, ok := s.instances[instanceID]
	if !ok {
		return kernel.InstanceRecord{}, kernel.InstanceNotFoundError{InstanceID: instanceID}
	}
	return kernel.InstanceRecord{State: cloneState(instance.state), Receipts: instance.receipts.snapshot()}, nil
}

func (s *MemoryStateStore) BeginEffect(_ context.Context, instanceID string, revision uint64, attempt kernel.ControlState) error {
	s.mu.Lock()
	defer s.mu.Unlock()
	instance, ok := s.instances[instanceID]
	if !ok {
		return kernel.InstanceNotFoundError{InstanceID: instanceID}
	}
	if instance.state.Revision != revision {
		return fmt.Errorf("stale revision")
	}
	instance.state = cloneState(attempt)
	return nil
}

func (s *MemoryStateStore) CommitTransition(_ context.Context, instanceID string, revision uint64, target kernel.ControlState, receipt kernel.Receipt) error {
	s.mu.Lock()
	defer s.mu.Unlock()
	instance, ok := s.instances[instanceID]
	if !ok {
		return kernel.InstanceNotFoundError{InstanceID: instanceID}
	}
	if s.commitFailures > 0 {
		s.commitFailures--
		return fmt.Errorf("simulated atomic transaction failure")
	}
	if instance.state.Revision != revision {
		return fmt.Errorf("stale revision")
	}
	instance.state = cloneState(target)
	instance.commits++
	instance.receipts.append(receipt)
	return nil
}

// currentInstance returns the fixture's active instance record. Fixture
// hooks act on this record; the kernel-facing Store methods never use it.
func (s *MemoryStateStore) currentInstance() *memoryInstance {
	instance, ok := s.instances[s.current]
	if !ok {
		panic(fmt.Sprintf("memory store has no current instance %q", s.current))
	}
	return instance
}

func (s *MemoryStateStore) snapshot() (kernel.ControlState, int) {
	s.mu.Lock()
	defer s.mu.Unlock()
	instance := s.currentInstance()
	return cloneState(instance.state), instance.commits
}

// instanceReceipts exposes the active instance's receipt log so white-box
// counterexample tests can rewrite committed history.
func (s *MemoryStateStore) instanceReceipts() *MemoryReceipts {
	s.mu.Lock()
	defer s.mu.Unlock()
	return s.currentInstance().receipts
}

func (s *MemoryStateStore) failNextCommit() {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.commitFailures++
}

// retarget provisions a separate control instance whose state mirrors the
// active one and makes it the fixture's active instance, so laws can address
// a prescription minted for one instance against another.
func (s *MemoryStateStore) retarget(instanceID string) {
	s.mu.Lock()
	defer s.mu.Unlock()
	state := cloneState(s.currentInstance().state)
	state.InstanceID = instanceID
	s.instances[instanceID] = &memoryInstance{state: state, receipts: &MemoryReceipts{}}
	s.current = instanceID
}

func (s *MemoryStateStore) isolate() {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.currentInstance().state.Mode = "isolated"
}

func (s *MemoryStateStore) bumpRevision() {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.currentInstance().state.Revision++
}

func (s *MemoryStateStore) retargetProgram(program kernel.ProgramIdentity) {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.currentInstance().state.Program = program
}

func (s *MemoryStateStore) rebind(objective kernel.Objective) {
	s.mu.Lock()
	defer s.mu.Unlock()
	binding, err := kernel.BindObjective(objective)
	if err != nil {
		panic(err)
	}
	s.currentInstance().state.ObjectiveBinding = &binding
}

// forceState overwrites the requested instance's state without any
// compare-and-swap, for dishonest white-box store variants.
func (s *MemoryStateStore) forceState(instanceID string, state kernel.ControlState) {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.instances[instanceID].state = cloneState(state)
}

// forceCommit commits state plus receipt without any compare-and-swap, for
// dishonest white-box store variants.
func (s *MemoryStateStore) forceCommit(instanceID string, target kernel.ControlState, receipt kernel.Receipt) {
	s.mu.Lock()
	defer s.mu.Unlock()
	instance := s.instances[instanceID]
	instance.state = cloneState(target)
	instance.commits++
	instance.receipts.append(receipt)
}

// forceMode tears a commit by mutating only the mode of the requested
// instance, for dishonest white-box store variants.
func (s *MemoryStateStore) forceMode(instanceID, mode string) {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.instances[instanceID].state.Mode = mode
}

// MemoryLocker serializes one control instance.
type MemoryLocker struct{ mu sync.Mutex }

func (l *MemoryLocker) Acquire(context.Context, string) (kernel.Lock, error) {
	l.mu.Lock()
	return memoryLock{mu: &l.mu}, nil
}

type memoryLock struct{ mu *sync.Mutex }

func (l memoryLock) Unlock() error {
	l.mu.Unlock()
	return nil
}

// FixedClock returns one deterministic, test-controlled time.
type FixedClock struct {
	mu   sync.Mutex
	Time time.Time
}

func (c *FixedClock) Now() time.Time {
	c.mu.Lock()
	defer c.mu.Unlock()
	return c.Time
}

func (c *FixedClock) advance(duration time.Duration) {
	c.mu.Lock()
	defer c.mu.Unlock()
	c.Time = c.Time.Add(duration)
}

// IntegerProgram compiles the reference control program.
func IntegerProgram() (kernel.Program, error) {
	return kernel.CompileDomainProgram("integer-control", "1.0.0", "kernel-v1", integerDomainContractFingerprint, "unbound", []string{"two"}, []kernel.Transition{
		{ID: "objective.bind", SourceModes: []string{"unbound"}, TargetMode: "zero", ObjectiveScope: kernel.ObjectiveNone, ObjectiveMutation: kernel.BindInitialObjective, RequiredCapabilities: []kernel.Capability{"objective.bind"}, OwnedFacets: []string{"supervisor.objective"}, Operation: "objective.bind", SelectionRank: 1, Selection: kernel.SelectionImplicit, Priority: 5},
		{ID: "counter.increment-first", SourceModes: []string{"zero"}, TargetMode: "one", ObjectiveScope: kernel.ObjectiveBoundExact, ObjectiveMutation: kernel.PreserveObjective, RequiredCapabilities: []kernel.Capability{"counter.increment"}, OwnedFacets: []string{"counter.value"}, Operation: "counter.increment", SelectionRank: 1, Selection: kernel.SelectionImplicit, Priority: 10},
		{ID: "counter.increment-second", SourceModes: []string{"one"}, TargetMode: "two", ObjectiveScope: kernel.ObjectiveBoundExact, ObjectiveMutation: kernel.PreserveObjective, RequiredCapabilities: []kernel.Capability{"counter.increment"}, OwnedFacets: []string{"counter.value"}, Operation: "counter.increment", SelectionRank: 1, Selection: kernel.SelectionImplicit, Priority: 10},
		{ID: "counter.reset", SourceModes: []string{"one", "two"}, TargetMode: "zero", ObjectiveScope: kernel.ObjectiveOptionalPreserve, ObjectiveMutation: kernel.PreserveObjective, RequiredCapabilities: []kernel.Capability{"counter.reset"}, OwnedFacets: []string{"counter.value"}, Operation: "counter.reset", SelectionRank: 1, Selection: kernel.SelectionImplicit, Priority: 20},
		{ID: "counter.hold", SourceModes: []string{"isolated", "zero"}, TargetMode: "zero", ObjectiveScope: kernel.ObjectiveOptionalPreserve, ObjectiveMutation: kernel.PreserveObjective, RequiredCapabilities: []kernel.Capability{"counter.hold"}, OwnedFacets: []string{"counter.value"}, Operation: "counter.hold", SelectionRank: 6, Selection: kernel.SelectionExplicitOnly, Priority: 30},
		{ID: "objective.recover", SourceModes: []string{"unbound"}, TargetMode: "unbound", ObjectiveScope: kernel.ObjectiveOptionalPreserve, ObjectiveMutation: kernel.PreserveObjective, RequiredCapabilities: []kernel.Capability{"counter.reset"}, OwnedFacets: []string{"counter.value"}, Operation: "counter.reset", SelectionRank: 1, Selection: kernel.SelectionImplicit, Priority: 1, Recovers: []string{"objective.bind"}},
		{ID: "counter.recover", SourceModes: []string{"isolated", "zero", "one", "two"}, TargetMode: "zero", ObjectiveScope: kernel.ObjectiveOptionalPreserve, ObjectiveMutation: kernel.PreserveObjective, RequiredCapabilities: []kernel.Capability{"counter.reset"}, OwnedFacets: []string{"counter.value"}, Operation: "counter.reset", SelectionRank: 1, Selection: kernel.SelectionImplicit, Priority: 1, Recovers: []string{"counter.hold", "counter.increment-first", "counter.increment-second", "counter.reset"}},
	})
}

// IntegerFixture returns the reusable reference conformance suite.
func IntegerFixture() KernelConformance {
	return newIntegerFixture(SetupUnbound)
}

func newIntegerFixture(setup Setup) KernelConformance {
	if !setup.valid() {
		panic(invalidSetup(setup))
	}
	program, err := IntegerProgram()
	if err != nil {
		panic(err)
	}
	objective, err := kernel.NewObjective("reach-two", 1, map[string]int{"value": 2})
	if err != nil {
		panic(err)
	}
	revised, err := kernel.NewObjective("reach-two", 2, map[string]int{"value": 3})
	if err != nil {
		panic(err)
	}
	conflicting, err := kernel.NewObjective("other", 1, map[string]int{"value": 0})
	if err != nil {
		panic(err)
	}
	alternateProgram, err := kernel.CompileDomainProgram(
		program.ID,
		program.Version,
		program.RuntimeCompatibility,
		alternateIntegerDomainContractFingerprint,
		program.InitialMode,
		program.MarkedModes,
		program.Transitions,
	)
	if err != nil {
		panic(err)
	}
	state := kernel.ControlState{InstanceID: "counter-fixture", Program: program.Identity(), Mode: "unbound", Revision: 1}
	value := 0
	switch setup {
	case SetupConcurrentSameBase:
		binding, bindErr := kernel.BindObjective(objective)
		if bindErr != nil {
			panic(bindErr)
		}
		state.Mode, state.ObjectiveBinding = "zero", &binding
	case SetupMaintenanceAbsent:
		state.Mode, value = "one", 1
	case SetupMaintenanceBound:
		binding, bindErr := kernel.BindObjective(objective)
		if bindErr != nil {
			panic(bindErr)
		}
		state.Mode, state.ObjectiveBinding, value = "one", &binding, 1
	}
	now := time.Date(2026, 8, 12, 10, 0, 0, 0, time.UTC)
	authority := kernel.Authority{Receipts: []kernel.AuthorityReceipt{{ID: "human-counter", Subject: "fixture", Fingerprint: "fixture-authority", Capabilities: []kernel.Capability{"counter.audit", "counter.hold", "counter.increment", "counter.reset", "objective.bind"}, IssuedAt: now.Add(-time.Minute), ExpiresAt: now.Add(24 * time.Hour)}}}
	domain := &IntegerDomain{value: value, executions: map[string]int{}}
	store := NewMemoryStateStore()
	if err := store.Create(context.Background(), state.InstanceID, state); err != nil {
		panic(err)
	}
	clock := &FixedClock{Time: now}
	fixture := KernelConformance{
		Domain:               domain,
		Operator:             IntegerOperator{Domain: domain},
		CapabilityClassifier: IntegerCapabilities{},
		Store:                store,
		Locker:               &MemoryLocker{},
		Clock:                clock,
		Program:              program,
	}
	fixture.Scenario = Scenario{
		InstanceID:             state.InstanceID,
		Objective:              objective,
		RevisedObjective:       revised,
		ConflictingObjective:   conflicting,
		AlternateProgram:       alternateProgram,
		Authority:              authority,
		BindTransition:         "objective.bind",
		AdvanceTransitions:     []string{"counter.increment-first", "counter.increment-second"},
		MaintenanceTransition:  "counter.reset",
		ExplicitOnlyTransition: "counter.hold",
		IsolateExplicitOnly:    store.isolate,
		RecoveryTransition:     "counter.recover",
		RecoveryCapability:     "counter.reset",
		ExtraCapability:        "counter.audit",
		ChangeObservation:      domain.changeObservation,
		RebindObjective:        store.rebind,
		BumpStateRevision:      store.bumpRevision,
		RetargetProgram:        store.retargetProgram,
		AdvanceClock:           clock.advance,
		IndependentLocker:      func() kernel.Locker { return &MemoryLocker{} },
		VerifyCommitted: func(before, after Snapshot, receipt kernel.Receipt) error {
			return verifyIntegerCommitted(program, before, after, receipt)
		},
		InterruptNextOperator: domain.interruptNext,
		PanicNextOperator:     domain.panicNext,
		FailNextCommit:        store.failNextCommit,
		RetargetInstance:      store.retarget,
		Snapshot: func() Snapshot {
			current, commits := store.snapshot()
			observation, observeErr := domain.Observe(context.Background(), current.InstanceID)
			if observeErr != nil {
				panic(observeErr)
			}
			return Snapshot{State: current, Observation: observation, Effects: domain.effectCounts(), Receipts: store.instanceReceipts().snapshot(), CommitCount: commits}
		},
	}
	fixture.New = func(_ testing.TB, requested Setup) KernelConformance {
		return newIntegerFixture(requested)
	}
	if setup == SetupBound {
		runtime, runtimeErr := kernel.NewRuntime(program, fixture.Domain, fixture.Operator, fixture.CapabilityClassifier, fixture.Store, fixture.Locker, fixture.Clock)
		if runtimeErr != nil {
			panic(runtimeErr)
		}
		for _, transition := range []string{fixture.Scenario.BindTransition, fixture.Scenario.AdvanceTransitions[0], fixture.Scenario.MaintenanceTransition} {
			request := kernel.ResolveRequest{InstanceID: state.InstanceID, Objective: &objective, Authority: authority, Requested: transition}
			resolution, resolveErr := runtime.Resolve(context.Background(), request)
			if resolveErr != nil || resolution.Prescription == nil {
				panic(fmt.Sprintf("seed bound fixture %s: decision=%#v error=%v", transition, resolution.Decision, resolveErr))
			}
			if _, applyErr := runtime.Apply(context.Background(), kernel.ApplyRequest{ResolveRequest: request, Prescription: *resolution.Prescription}); applyErr != nil {
				panic(applyErr)
			}
		}
	}
	return fixture
}

func verifyIntegerCommitted(program kernel.Program, before, after Snapshot, receipt kernel.Receipt) error {
	var prior, result struct {
		Value int `json:"value"`
	}
	if err := json.Unmarshal(before.Observation.Value, &prior); err != nil {
		return err
	}
	if err := json.Unmarshal(after.Observation.Value, &result); err != nil {
		return err
	}
	transition, ok := program.Transition(receipt.TransitionID)
	if !ok {
		return fmt.Errorf("unknown transition %q", receipt.TransitionID)
	}
	facet := "counter.value"
	if transition.Operation == "objective.bind" {
		facet = "supervisor.objective"
	}
	expectedFact := kernel.EffectFact{Facet: facet, Operation: transition.Operation, Fingerprint: fmt.Sprintf("value-%d", result.Value)}
	if len(receipt.Effects) != 1 || receipt.Effects[0] != expectedFact {
		return fmt.Errorf("receipt effect facts %#v differ from independent evidence %#v", receipt.Effects, expectedFact)
	}
	switch transition.Operation {
	case "objective.bind":
		if result.Value != prior.Value {
			return fmt.Errorf("objective binding changed value from %d to %d", prior.Value, result.Value)
		}
	case "counter.increment":
		if result.Value != prior.Value+1 {
			return fmt.Errorf("increment changed value from %d to %d", prior.Value, result.Value)
		}
	case "counter.reset":
		if result.Value != 0 {
			return fmt.Errorf("reset left value at %d", result.Value)
		}
	case "counter.hold":
		if result.Value != prior.Value {
			return fmt.Errorf("hold changed value from %d to %d", prior.Value, result.Value)
		}
	default:
		return fmt.Errorf("unsupported operation %q", transition.Operation)
	}
	return nil
}

func cloneState(state kernel.ControlState) kernel.ControlState {
	copy := state
	if state.ObjectiveBinding != nil {
		binding := *state.ObjectiveBinding
		copy.ObjectiveBinding = &binding
	}
	if state.Recovery != nil {
		recovery := *state.Recovery
		copy.Recovery = &recovery
	}
	return copy
}